Analysis
-
max time kernel
94s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 13:30
Static task
static1
Behavioral task
behavioral1
Sample
f61dc542f0b6a4381a0e7077b69bce6c_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f61dc542f0b6a4381a0e7077b69bce6c_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
f61dc542f0b6a4381a0e7077b69bce6c_JaffaCakes118.dll
-
Size
253KB
-
MD5
f61dc542f0b6a4381a0e7077b69bce6c
-
SHA1
6f6a0df1f105ebb1d76b7b21804983d9ff7ff9d9
-
SHA256
36466cd81cb47f843be3f31b2e0b21497c0b9dcbc054bf35c615cb74cbd1714a
-
SHA512
cf4e1a8d13dd77fde30ccc8042e31d60e3013f57579f373084c1ca5655da4ce9fd0d15c125942c318bab9c2987a9719268703213687f8e8c31ec5176ca694adc
-
SSDEEP
6144:wp78nMINWDBVEASAj9Fl13ATzbttb8IWZ9f9:0IN8fEcsTXtmD
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2160 wrote to memory of 4800 2160 regsvr32.exe 82 PID 2160 wrote to memory of 4800 2160 regsvr32.exe 82 PID 2160 wrote to memory of 4800 2160 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\f61dc542f0b6a4381a0e7077b69bce6c_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\f61dc542f0b6a4381a0e7077b69bce6c_JaffaCakes118.dll2⤵
- System Location Discovery: System Language Discovery
PID:4800
-